The Administrator, Promoter, Prize Providers, and third-party service providers value your privacy and want to give Eligible Entrant the opportunity to know what Personal Information is collected about Eligible Entrant, that Eligible Entrants Personal Information is protected, used, disclosed, and otherwise managed in conformance with all applicable law. This Privacy Statement applies to the collection of Personal Information solely in connection with the “SUBCARD® Monthly Promotion.”

In an effort to comply with the law and our commitment to protect your Personal Information, SFAFT BV encourages you to review the Privacy Policy of the Administrator, Simplicity Australasia Ltd and SFAFT BV’s third-party service providers, Subcard® NZ Limited (“SNZ”), and Customer Portfolios, LLC’s (“CP”), located in the United States of America (“USA”), which discloses each individual companies full privacy practices and procedures. For your convenience, SFAFT BV has provided Simplicity Australasia Ltd, SNZ, and CP’s individual Privacy Policy links below:

The “SUBCARD® Monthly Promotion” Privacy Statement does not govern the privacy practices and procedures of independently owned and operated Subway® Restaurants. Nor does the “SUBCARD®Monthly Promotion” Privacy Statement govern the Personal Information handling practices and procedures of its affiliates, the FAF Group, including but is not limited to: SFAFT BV. The FAF Group administers national and local advertising funds and activity for Subway® restaurants and Subway® franchisees worldwide. The Subway® Group, an affiliate of the FAF Group, includes, but is not limited to: Franchise World Headquarters LLC (“FWH”) and Subway IP Inc. (“SII”). FWH operates as a service-oriented company for and on behalf of the Subway® System worldwide by providing core business related services to the Subway® franchising entities. SIP owns and licenses the Subway® trademark and Subway® Restaurant System in order to develop Subway® restaurants worldwide to its affiliates within the Subway® group, including, but not limited to, Subway International B.V. (“SIBV”), the franchisor licensed to sell Subway® restaurants in New Zealand.

SFAFT BV encourages you to review its affiliates, FWH, SIBV, and SFAFT’s respective Privacy Statements which disclose each company’s privacy practices and procedures. For your convenience, SFAFT BV has provided links to FWH, SIBV, and SFAFT’s individual Privacy Statements, as well as, the Subway® Privacy Notice which includes the individual Subway® Group franchisor Privacy Statements located at:

To find out more about SFAFT BV’s privacy practices and procedures, please see our Privacy Statement located at: https://www.subway.co.nz/Privacy-Policy, which discloses SFAFT BV’s full privacy practices and procedures.

INTRODUCTION

SFAFT BV’s role in the “SUBCARD® Monthly Promotion” is limited to promoting the Promotion, drafting the rules for the Promotion, contacting all monthly prize winners, and fulfilling all monthly prizes throughout the “SUBCARD® Monthly Promotion” Period. SFAFT BV hired Simplicity Australasia Ltd to run and administer the “SUBCARD® Monthly Promotion” on behalf of SFAFT BV. Simplicity Australasia Ltd’s role is limited to housing all entries in the promotional database and conducting all prize draws throughout the “SUBCARD® Monthly Promotion” Period. SFAFT BV’s third-party service provider, SNZ, manages the SUBCARD® website. SFAFT BV’s third-party service provider CP, located in the USA, may send Entrant opt-in information or materials specifically requested by Entrant at the time of entering the “SUBCARD® Monthly Promotion,” on behalf of SFAFT BV. The “SUBCARD®Monthly Promotion” gathers Personal Information from Eligible Entrants who choose to enter the Promotion. SFAFT BV, Simplicity Australasia Ltd, SNZ, and CP take our privacy obligations both to our customers and Eligible Entrants who choose to enter the “SUBCARD® Monthly Promotion” very seriously and will take all reasonable steps to protect Eligible Entrants Personal Information which may be in our control.

PURPOSE

This Privacy Statement outlines the treatment of Personal Information collected from Eligible Entrants s solelyolely in connection with the “SUBCARD® Monthly Promotion”

PERSONAL INFORMATION COLLECTED

The Administrator and/or Promoter may collect Personal Information, which may include, but is not limited to: name (full name or first initial and last name), maiden name, nickname, email address, home address, home postal code, home telephone number, mobile telephone number, date of birth, Social Security Number and/or Identification Number, photographic images (especially of face or other identifying characteristics, or other identifying characteristics such as eye, skin, and hair color, facial features, and personal marks such as tattoos, birthmarks, moles and scars) and video or voice recording. This Personal Information is only collected when volunteered by the Eligible Entrant. Upon entering your Personal Information for the Promotion, you may have the opportunity to Opt-in (which requires Eligible Entrants express consent) and receive specific information or materials, such as, a coupon, newsletter, informational materials, marketing communications, or other special promotions or offers, from the FAF Group, the Subway® Group, or our third-party service provider (located in the United States of America). When entering your Personal Information regarding the “SUBCARD® Monthly Promotion,”the Promoter SFAFT BV, its affiliates, such as, but not limited to: other members within of the FAF Group, the Subway® Group, and/or SFAFT BV’s third-party service providers, are contractually obligated to provide the same level of guarantees regarding the confidentiality and security of your Personal Information, as well as, to allow for oversight, monitoring, and auditing of the services being provided solely in connection with the “SUBCARD® Monthly Promotion.” Should the “SUBCARD®Monthly Promotion” require Eligible Entrant to create a User ID and/or Password, SFAFT BV will not divulge Eligible Entrants User ID and/or Password to anyone internally or externally.

NON-PERSONAL INFORMATION

The Administrator and/or Promoter may also collect Non-Personal Information, such as Internet Protocol (IP) addresses, "cookies," and Internet tags and navigational data (server log files). "Cookies" are small pieces of information that are stored by your web browser software on your computer's hard drive or temporarily in your computer's memory. The use of cookies is now an industry standard and users will find them on most major websites. The Administrator and/or Promoter may place and store Internet cookies on the Eligible Entrants hard drive. Cookies can save any of the types of information noted above. Although most web browsers are initially set up to accept cookies, if you prefer, you can decline the placement of a cookie on your hard drive by using the appropriate feature(s) of your web browser software (if available) to delete the cookie.

MOBILE INFORMATION

The Administrator and Promoter use a variety of new technologies and Social Media options to communicate and interact with consumers. These websites and mobile applications include popular social networking and media sites, such as, but not limited to: Facebook, Twitter, YouTube, Foursquare, Google+, Pinterest, Instagram, LinkedIn, etc. If you post updates to, or receive updates from, any social networking websites during the Promotion Period via SMS from your wireless phone, your wireless-service provider may charge you for each text message you send and receive. You must consult your wireless service provider regarding its pricing plans, as rates may vary. Use of third party social networking websites, such as, but not limited to: Facebook, Twitter, YouTube, Foursquare, Google+, Pinterest, Instagram, LinkedIn, etc., are governed by the privacy practices and procedures of those websites. Neither, the Administrator nor Promoter, captures or stores Eligible Entrants login information or any other Personal Information connected with Eligible Entrants Facebook, Twitter, YouTube, Foursquare, Google+, Pinterest, Instagram, LinkedIn, etc., or any other social networks. However, session information or cookies may be stored on Eligible Entrants wireless phone, by the social networking websites.

SOCIAL MEDIA

Please note, if the “SUBCARD® Monthly Promotion” is being run via a Social Media Platform(s) such as, but not limited to: Facebook, Twitter, YouTube, Foursquare, Google+, Pinterest, Instagram, LinkedIn, etc., all Eligible Entrants acknowledge that the “SUBCARD® Monthly Promotion” is in no way sponsored, endorsed, administered by, or associated with the Social Media Platform(s) and to the full extent permitted by law, the Social Media Platform(s) will not be liable to any Eligible Entrant in respect to any claim whatsoever including, but not limited to: any loss, damage or injury, or for any physical or mental injury suffered by any Eligible Entrant for any reason, as a result of, or in connection with the “SUBCARD® Monthly Promotion.”

SPECIAL NOTE ABOUT CHILDREN

The “SUBCARD® Monthly Promotion” is not targeted towards children under the age of thirteen (13). The age of which an individual is no longer considered a minor varies from country to country. If you are unsure what the age of majority is for your country, please check with an adult to find out if you may still be considered a minor. The Administrator and SFAFT BV understands that a minor may still try to contact Administrator and/or SFAFT BV and in so doing may voluntarily provide Administrator and/or SFAFT BV Personal Information. If you are under the age of thirteen (13), PLEASE DO NOT submit any Personal Information about yourself for this Contest. If you still choose to enter the “SUBCARD® Monthly Promotion” the Administrator and/or SFAFT BV ask you not to enter the Contest WITHOUT GETTING PERMISSION FROM YOUR PARENT(S) OR GUARDIAN(S) FIRST.

Children’s privacy is very important to the Administrator and Promoter. SFAFT BV, an affiliate of the Subway® Group, whose servers are located in the United States, adheres to the United States Children's Online Privacy Protection Act (“COPPA”). The Federal Trade Commission (“FTC”) has the authority to issue regulations and enforce COPPA, which applies to websites and online services operated for commercial purposes that are directed at, and are collecting Personal Information from children under thirteen (13) years of age. COPPA explains what a website operator must include in their Privacy Statement, what responsibilities a website operator has to protect children's privacy and safety online, including restrictions on marketing to those under thirteen (13) years of age, it also requires that we inform parents and/or legal guardians how we collect, use, and disclose Personal Information from children under thirteen (13) years of age, as well as, how to obtain verifiable consent from a parent in order for children to use certain features of on a website. The Administrator and/or Promoter will not knowingly allow anyone under thirteen (13) years of age to provide us with any Personal Information about themselves (such as their names, e-mail address, and phone number) over the Internet. If a child has provided the Administrator and/or Promoter with Personal Information without the consent of a parent, we ask the parent of that child to contact Simplicity Australasia Ltd’s Privacy Officer immediately at: Nicole.Sturzaker@simplicitycrm.com, or SFAFT BV’s Privacy Officer at: privacyofficer_nz@subway.com. We will use all reasonable efforts to promptly delete the child's information from our servers. Please note, that when we use the term "parent", we mean to include legal guardians.

By entering the “SUBCARD® Monthly Promotion,” each entrant (if a minor, Eligible Entrants parent/legal guardian) agrees to the publication, reproduction and/or other use of his/her name, address, voice, image, statements about the “SUBCARD® Monthly Promotion,” photograph and/or other likeness without further notice or compensation, in any publicity or advertisement carried out by or on behalf of the Promoter, solely regarding the “SUBCARD® Monthly Promotion,” including, but limited to: print, broadcast, the internet (including social media), and on the “SUBCARD® Monthly Promotion” winners’ list. By participating, in the “SUBCARD® Monthly Promotion,” Eligible Entrant (if a minor, Eligible Entrants parent/legal guardian) agrees to the “SUBCARD® Monthly Promotion” Privacy Statement located and Official Rules located at: https://www.subcard.co.nz/promotion-tandcs

SIMPLICITY AUSTRALASIA LTD SECURITY

Simplicity Australasia Ltd endeavours to protect your Personal Information using physical, electronic or procedural security measures appropriate to the sensitivity of the information in its control. These measures include safeguards to protect Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use and modification. Simplicity Australasia Ltd safeguards your Personal Information on the Internet by using industry-standard practices. Although "guaranteed security" does not exist either on or off the Internet, Simplicity Australasia Ltd makes commercially reasonable efforts to make the collection and security of such information consistent with its Privacy Statement and all applicable laws and regulations. Simplicity Australasia Ltd maintains physical, electronic and procedural safeguards as appropriate to safeguard your Personal Information.

SFAFT BV’S SECURITY

SFAFT BV endeavours to protect your Personal Information using physical, electronic or procedural security measures appropriate to the sensitivity of the information in our control. We safeguard your Personal Information on the Internet by using industry-standard practices. Although "guaranteed security" does not exist either on or off the Internet, we make commercially reasonable efforts to make the collection and security of such information consistent with our Privacy Statement and all applicable laws and regulations.

Currently, our website utilizes a variety of different security measures designed to protect Personal Information by users both inside and outside SFAFT BV, including the use of encryption mechanisms (e.g., Secure Socket Layers or SSLs), password protection, and other security measures to help prevent unauthorized access to your Personal Information. This helps maintain the confidentiality, privacy, and integrity of your transactions, and helps to protect your confidential information - such as, credit card numbers, online forms, and financial data from loss, misuse, interception and hacking.

Simplicity Australasia Ltd ensures that Personal Information is safeguarded against loss, access, use, modification, disclosure or other misuse. All reasonable steps are taken to prevent unauthorized use or disclosure of your Personal Information.

Simplicity Australasia Ltd will retain your Personal Information only for as long as necessary to fulfill the purpose(s) for which it was collected and to comply with applicable laws.

Simplicity Australasia Ltd takes all reasonable steps to ensure that your Personal Information is accurate, up to date, complete, relevant and not misleading.

SFAFT BV’S STORAGE, RETENTION, AND ACCURACY OF PERSONAL INFORMATION

All reasonable steps are taken to safeguard your Personal Information against loss; unauthorized access, use, modification, disclosure; or any other misuse. SFAFT BV takes all reasonable steps to insure that your Personal Information is accurate, up-to-date, complete, relevant and not misleading. SFAFT BV will retain your Personal Information only for as long as necessary to fulfill the purpose(s) for which it was collected and to comply with applicable laws. Your consent to such purpose(s) remains valid after termination of our relationship with you.

SFAFT BV may store your Personal Information in its databases located in the United States and/or other countries outside of Australia. Additionally, some of our service providers may be located in the United States or other countries outside of Australia and will be subject to the laws of the local jurisdiction. As a result, in certain circumstances, the United States and other foreign governments, courts, law enforcement agencies or regulatory agencies may be entitled to access the Personal Information collected and held by SFAFT BV.

You may contact Simplicity Australasia Ltd Privacy Officer to access, correct or delete your Personal Information. If necessary, the Privacy Officer will contact another individual to assist in completing your requested task. We want to be sure that we keep only the most accurate and up-to-date Personal Information in our records. You can email the Privacy Officer at: Nicole.Sturzaker@simplicitycrm.com to update your contact information. To protect your privacy, we will take all reasonable steps to help verify your identity before granting access or making any changes.

SFAFT BV’S ACCESS, CONTROL, AND UPDATE OF PERSONAL INFORMATION

You may contact SFAFT BV’s Privacy Officer to access, correct or delete your Personal Information. If necessary, the Privacy Officer will contact another individual to assist in completing your requested task. SFAFT BV wants to be sure that we keep only the most accurate and up-to-date Personal Information in our records. You can email SFAFT BV’s Privacy Officer at: privacyofficer_nz@subway.com to update your contact information. To protect your privacy, SFAFT BV will take all reasonable steps to help verify your identity before granting access or making any changes to your Personal Information.

SIMPLICITY AUSTRALASIA LTD PRIVACY OFFICER CONTACT INFORMATION

If you have any questions or concerns, please contact Simplicity Australasia Ltd Privacy Officer as follows:

SFAFT BV’S PRIVACY OFFICER CONTACT INFORMATION

If after reviewing the “SUBCARD® Monthly Promotion” Privacy Statement, and you would like to submit a request or you have any questions or privacy concerns, please contact SFAFT BV’s Privacy Officer at:

Where allowed by law, you may also use the above email or postal address to request access to Personal Information held about you by SFAFT BV. Such requests will be processed in line with local laws, where it is legally permissible to do so. There may be circumstances where SFAFT BV is unable to provide access, including but not limited to: where the information contains legal privilege, is a security risk, would compromise others’ privacy, or where it is commercially proprietary. You may also ask SFAFT BV to update Personal Information we hold about you where you believe it is incomplete, inaccurate or out of date.

SFAFT BV will address your concerns and attempt to resolve any privacy issues in a timely manner.

*SFAFT BV may update its Privacy Statement occasionally. When SFAFT BV posts changes to its Privacy Statement, we will also revise the "LAST REVIEWED" date on SFAFT BV’s Privacy Statement. If there are material changes to our Privacy Statement, SFAFT BV will notify you by email, or by means of a notice on our website located at: http://www.subway.co.nz. SFAFT BV encourages you to periodically review our full Privacy Statement located at: https://www.subway.co.nz/Privacy-Policy, in order for you to stay informed of how SFAFT BV is protecting your Personal Information and to be aware of any material changes we may make to our Privacy Statement. Lastly, your continued use of SFAFT BV’s website after posting an amended Privacy Statement shall constitute your agreement to be bound by any such changes, which are effective immediately after being posted on SFAFT BV’s website.